|Publication number||US7133883 B2|
|Application number||US 10/329,077|
|Publication date||Nov 7, 2006|
|Filing date||Dec 23, 2002|
|Priority date||Dec 23, 2002|
|Also published as||US20040133539|
|Publication number||10329077, 329077, US 7133883 B2, US 7133883B2, US-B2-7133883, US7133883 B2, US7133883B2|
|Inventors||Nisha D. Talagala, Brian Wong|
|Original Assignee||Sun Microsystems, Inc.|
|Export Citation||BiBTeX, EndNote, RefMan|
|Patent Citations (41), Non-Patent Citations (1), Referenced by (7), Classifications (10), Legal Events (5)|
|External Links: USPTO, USPTO Assignment, Espacenet|
This invention relates generally to data integrity, and more particularly to diagnosing data corruptions.
Data corruption is a major problem in large-scale data storage systems and in data transmission systems. In the short term, the corrupted data cause applications to return erroneous results and may result in the failure of the applications. Over the long term, the corrupted data may be replicated through multiple systems. In many instances, if the corruption is detected and the cause determined, the correct data may be recoverable.
Data corruptions may be detected in various ways. For example, one approach has been to associate integrity metadata, such as data checksums, embedded logical block addresses, etc., with the data on writes and to verify the data using the integrity data on reads. However, while integrity metadata can be used to detect data corruption, it cannot by itself determine the cause of the corruption. For example, if a piece of data does not match its corresponding integrity metadata, either the data or the integrity metadata may be corrupt and, without additional information, it is not possible to determine which item is faulty.
Similarly, data redundancy may be used to detect data corruption, but the same problem arises. When the original data and the redundant data do not match, without additional information, it is not possible to determine which of the two copies is correct.
Diagnosis of corruption in interrelated data entities uses a graph of nodes and edges. Datum nodes represent the data entities, relationship nodes represent the relationships among the data entities. The datum nodes are connected through their relationship nodes by the edges. When corruption is detected, the relationships are analyzed and each edge connecting a datum node to a relationship node is removed from the graph when the corresponding relationship is invalid. The datum nodes that remain connected to their relationship nodes form a subgraph and the corresponding data entities are considered correct. In one aspect, if more than one subgraph is formed, the datum nodes in the largest are used. In another aspect, the data entities and relationships are analyzed to create the graph when the data entities are assumed correct. The data entities may be data and metadata of various types that can be associated with the data.
The present invention is described in conjunction with systems, methods, and machine-readable media of varying scope. In addition to the aspects of the present invention described in this summary, further aspects of the invention will become apparent by reference to the drawings and by reading the detailed description that follows.
In the following detailed description of embodiments of the invention, reference is made to the accompanying drawings in which like references indicate similar elements, and in which is shown by way of illustration specific embodiments in which the invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention, and it is to be understood that other embodiments may be utilized and that logical, mechanical, electrical, functional and other changes may be made without departing from the scope of the present invention. The following detailed description is, therefore, not to be taken in a limiting sense, and the scope of the present invention is defined only by the appended claims.
An arrangement of data entities, such as found in storage or transmission environments, and certain relationships among the data entities are abstracted into graphs. The relationships may be data-to-data, data-to-metadata, or metadata-to-metadata, and share the property that if the relationship is valid, it can be assumed the participating data entities are correct. The data and metadata are represented by data/metadata (“datum”) nodes and the relationships by relationship nodes in the graph. Instead of being directly connected by edges in the graph, the datum nodes are connected through the corresponding relationship node.
The metadata may be commonly used integrity metadata, such as error correction codes (ECC), circular redundancy codes (CRC), checksums, or the like, but the invention is not limited to use with only integrity metadata. Additionally, such integrity metadata is not limited to a single piece of data but may be comprised of multiple parts, such as a checksum, an embedded logical block address, and a generation number. Each part of the integrity metadata would be represented in the graph by its own datum node with an edge to the corresponding data-metadata relationship node.
The graph is subsequently used to diagnose the cause of data corruption in the arrangement when corruption is detected. Various mechanisms may be used to detect data corruption, such as those disclosed in pending U.S. patent application Ser. No. 10/222,074 titled “Efficient Mechanisms for Detecting Phantom Write Errors” filed on Aug. 15, 2002 and assigned to the assignee of the present invention.
A simple arrangement 100 of data entities that incorporates data redundancy and integrity, such as would be found in an array of mirrored disks that also store parity or error correction information for the data, is shown in
A more complex arrangement 120 is illustrated in
The corresponding graph 130 represents data 101, 103 as datum nodes 111, 113, and metadata 105, 107 as metadata nodes 115, 117. Relationship nodes 112, 114, 116 and 118 correspond to the mirroring and integrity relationships among the data entities in the arrangement 120. The implied relationships in arrangement 120 between data 101 and metadata 107, and between data 103 and metadata 105 are represented in graph 130 by relationship nodes 121, 123, respectively.
The arrangements 100 and 120 of
The invention is particularly applicable in environments in which the data participates in very complex relationships, such as found in RAID (redundant array of independent disks) storage subsystems in which the data is written in “stripes” over several physical disks to form a larger logical disk and to maximize throughput in the subsystem. Various levels of RAID also include parity data that enables recovery of the data when a drive fails by calculating the exclusive OR (XOR) of the remaining data and the parity data.
Turning now to
When data 101 in
Starting with working graph 210, analysis of the relationships in data arrangement 120 of
Similarly, as shown in
As described in conjunction with FIGS. 1A–C and 2A–C, data corruption may be diagnosed through graphs containing datum nodes that represent the potentially corrupted data entities and that are connected through relationship nodes that represent relationships among the data entities. While the invention is not limited to application in any particular arrangement of data entities, for sake of clarity three exemplary data arrangements have been described. Connecting the datum nodes through the relationship nodes enables diagnosis graphs to be created for highly complex data storage arrangements, such as RAID 5 in which inter-related data, parity data, and metadata are distributed across an array of disks. Furthermore, the relationship nodes allow the diagnosis of data corruption in arrangements in which more than two entities participate in a relationship. Additional types of data arrangements in which the invention may employed include networks, memory and disk caches, and data states within computer systems.
Next, the particular methods performed by a processor to diagnose data corruption are described with reference to flowcharts in
In some instances, such as when too many data entities are corrupted or when the data entities are corrupted in such a way that some of the relationships between the faulty data entities remain valid, the method 300 may not be able to complete the diagnosis. In the first case, no unique largest subgraph may be found (block 315). In the second case, all the nodes that participate in one or more invalid relationships between the data entities may belong to the largest subgraph, leading to disagreement among its nodes (block 317). In both cases, the method 300 is unable to determine the correct data entities and performs appropriate error processing (block 321). Depending on implementation, the error processing at block 321 may transfer control to an alternate diagnosis mechanism, return a failure message to alert an operator of the problem, or execute other such contingency procedures.
Various algorithms may be employed to determine the largest subgraph at block 313. For example, it may the subgraph with the most datum nodes, the subgraph with the most relationship nodes, or the largest number of total nodes. Additionally, the nodes may be weighted and the subgraphs with the highest weight designated as the largest. Furthermore, if the primary criteria, e.g., datum nodes, results in a tie between subgraphs, secondary criteria, e.g., total nodes, may be used to select among the subgraphs.
Data storage system 500A also contains an array controller 520 that controls the operation of the disk array. Array controller 520 provides the capability for data storage system 500A to perform tasks and execute software programs stored within the data storage system. Array controller 520 includes one or more processors 524, memory 522 and non-volatile storage 526 (e.g., non-volatile access memory (NVRAM), flash memory, etc.). Memory 522 may be random access memory (RAM) or some other machine-readable medium, for storing program code (e.g., software for performing any method of the present invention) that may be executed by processor 520. The machine-readable medium may include a mechanism that provides (i.e., stores and/or transmits) information in a form readable by a machine such as a computer or digital processing device. For example, a machine-readable medium may include a read only memory (ROM), random access memory (RAM), magnetic disk storage media, optical storage media, flash memory devices, etc. The code or instructions may be represented by carrier-wave signals, infrared signals, digital signals, and by other like signals. Non-volatile storage 526 is a durable data storage area in which data remains valid during intentional and unintentional shutdowns of data storage system 500A.
In one embodiment, controller 520 includes a data corruption diagnosis module 528 for determining the source of data corruption within the data storage system 500A as described above. Module 528 may be implemented in hardware, software, or a combination of both. In one embodiment, software module 528 is stored in memory 522. The module 528 may also create the initial graph used in the diagnosis or the graph may be created by a separate module. The graph may be cached in memory 522 or stored on non-volatile storage 526.
Module 528 may or may not reside in controller 520. Specifically, module 528 may be implemented anywhere within the block-based portion of the I/O datapath. The datapath referred to herein represents any software, hardware, or other entities that manipulate data in block form (i.e., from the time the data enters block form on write operations to the point where the data leaves block form on read operations). The datapath extends from the computer that reads or writes the data (converting it into block form) to the storage device where the data resides during storage. For example, the datapath may include software modules such as volume managers that stripe or replicate the data, the disk arrays that store the data blocks, the portion of the file system that manages data in blocks, the network that transfers the blocks, etc.
In one embodiment, computer 505 includes non-volatile storage 532 (e.g., NVRAM, flash memory, etc.) that stores the graph created for the data storage system when it is assumed that the data is correct and may also may be cached in memory 534 when diagnosing corruption in the data storage system. In one embodiment, memory 534 stores software module 528 and other program code that can be executed by processor 530. Memory 534 may be RAM or some other machine-readable medium. The machine-readable medium may include a mechanism that provides (i.e., stores and/or transmits) information in a form readable by a machine such as a computer or digital processing device. For example, a machine-readable medium may include a read only memory (ROM), random access memory (RAM), magnetic disk storage media, optical storage media, flash memory devices, etc. The code or instructions may be represented by carrier-wave signals, infrared signals, digital signals, and by other like signals.
The diagnosis of corruption in data entities other than data storage systems may be performed by a machine such as computer system 540 illustrated in
The computer system 540 includes a processor 542, a main memory 544, and a static memory 546, such as non-volatile storage, which communicate with each other via a bus 548. The computer system 540 may further include a video display unit 50, an alpha-numeric input device 52, a cursor control device 54, a disk drive unit 56, a signal generation device 560 and a network interface device 562.
The disk drive unit 56 includes a machine-readable medium 564 on which is stored a set of instructions or modules 566 embodying any one, or all, of the methodologies described above. The instructions 566 are also shown to reside, completely or at least partially, within the main memory 544 and/or within the processor 542. The disk drive unit 56 is typically one or more disk drives that do not participate in the redundancy relationships previously described for
The computer system 540 interfaces to external systems through the modem or network interface 562. It will be appreciated that the modem or network interface 562 can be considered to be part of the computer system 540. This interface 562 can be an analog modem, ISDN modem, cable modem, token ring interface, satellite transmission interface (e.g. “Direct PC”), or other interfaces for coupling a computer system to other computer systems. The computer system 540 and the external systems can be connected in a local area network (LAN) configuration, in a wide-area network WAN configuration, or in a storage area network (SAN) (generically represented as network 563). The network 563 can be either public or private.
It will be appreciated that the computer system 540 is one example of many possible computer systems which have different architectures and are controlled by operating systems software, such as Solaris™ from Sun Microsystems, Inc. One of skill in the art will immediately appreciate that the invention can be practiced with other computer system configurations, including hand-held devices, multiprocessor systems, microprocessor-based or programmable consumer electronics, network PCs, minicomputers, mainframe computers, and the like. The invention can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. Thus, the description of
Diagnosis of data corruption in related data entities has been described as using graphs with edges that connect datum nodes to relationship nodes. Although specific embodiments have been illustrated and described herein, it will be appreciated by those of ordinary skill in the art that any arrangement which is calculated to achieve the same purpose may be substituted for the specific embodiments shown. This application is intended to cover any adaptations or variations of the present invention. Therefore, it is manifestly intended that this invention be limited only by the following claims and equivalents thereof
|Cited Patent||Filing date||Publication date||Applicant||Title|
|US4479196 *||Nov 15, 1982||Oct 23, 1984||At&T Bell Laboratories||Hyperedge entity-relationship data base systems|
|US5197148||Jul 18, 1990||Mar 23, 1993||International Business Machines Corporation||Method for maintaining data availability after component failure included denying access to others while completing by one of the microprocessor systems an atomic transaction changing a portion of the multiple copies of data|
|US5201044||Apr 16, 1990||Apr 6, 1993||International Business Machines Corporation||Data processing method for file status recovery includes providing a log file of atomic transactions that may span both volatile and non volatile memory|
|US5206939||Sep 24, 1990||Apr 27, 1993||Emc Corporation||System and method for disk mapping and data retrieval|
|US5692184 *||May 9, 1995||Nov 25, 1997||Intergraph Corporation||Object relationship management system|
|US5720026||May 7, 1996||Feb 17, 1998||Mitsubishi Denki Kabushiki Kaisha||Incremental backup system|
|US5796934||May 31, 1996||Aug 18, 1998||Oracle Corporation||Fault tolerant client server system|
|US5819275 *||Jun 7, 1995||Oct 6, 1998||Trusted Information Systems, Inc.||System and method for superimposing attributes on hierarchically organized file systems|
|US5835085 *||Aug 13, 1997||Nov 10, 1998||Lucent Technologies Inc.||Graphical display of relationships|
|US5889934||Feb 24, 1997||Mar 30, 1999||Data General Corporation||Data validation system for a group of data storage disks|
|US5909688 *||Oct 9, 1997||Jun 1, 1999||Fujitsu Limited||Information management system|
|US5933831 *||Jan 9, 1998||Aug 3, 1999||Lsi Logic Corporation||Viewing entity relationship diagrams using hyperlinks|
|US5995308||Mar 31, 1997||Nov 30, 1999||Stmicroelectronics N.V.||Disk resident defective data sector information management system on a headerless magnetic disk device|
|US6009542||Mar 31, 1998||Dec 28, 1999||Quantum Corporation||Method for preventing transfer of data to corrupt addresses|
|US6343343||Jul 31, 1998||Jan 29, 2002||International Business Machines Corporation||Disk arrays using non-standard sector sizes|
|US6347359||Feb 19, 1999||Feb 12, 2002||Aiwa Raid Technology, Inc.||Method for reconfiguration of RAID data storage systems|
|US6397309||Mar 12, 2001||May 28, 2002||Emc Corporation||System and method for reconstructing data associated with protected storage volume stored in multiple modules of back-up mass data storage facility|
|US6408416||Jun 16, 1999||Jun 18, 2002||Hewlett-Packard Company||Data writing to data storage medium|
|US6418519||Nov 28, 2000||Jul 9, 2002||International Business Machines Corporation||Multi-volume, write-behind data storage in a distributed processing system|
|US6438591 *||Jul 5, 2000||Aug 20, 2002||Compaq Information Technologies Group L.P.||Entity management system|
|US6467060||Jun 25, 1999||Oct 15, 2002||Seagate Technology Llc||Mass storage error correction and detection system, method and article of manufacture|
|US6476814 *||Jun 25, 1998||Nov 5, 2002||Wordgraph, Inc.||Display structure for representation of complex systems|
|US6484185||Apr 5, 1999||Nov 19, 2002||Microsoft Corporation||Atomic operations on data structures|
|US6553511||May 17, 2000||Apr 22, 2003||Lsi Logic Corporation||Mass storage data integrity-assuring technique utilizing sequence and revision number metadata|
|US6584544||Jul 12, 2000||Jun 24, 2003||Emc Corporation||Method and apparatus for preparing a disk for use in a disk array|
|US6587962||Oct 20, 1999||Jul 1, 2003||Hewlett-Packard Development Company, L.P.||Write request protection upon failure in a multi-computer system|
|US6606629||May 17, 2000||Aug 12, 2003||Lsi Logic Corporation||Data structures containing sequence and revision number metadata used in mass storage data integrity-assuring technique|
|US6629273||Jan 24, 2000||Sep 30, 2003||Hewlett-Packard Development Company, L.P.||Detection of silent data corruption in a storage system|
|US6684289||Nov 22, 2000||Jan 27, 2004||Sandisk Corporation||Techniques for operating non-volatile memory systems with data sectors having different sizes than the sizes of the pages and/or blocks of the memory|
|US6687791||Jan 7, 2002||Feb 3, 2004||Sun Microsystems, Inc.||Shared cache for data integrity operations|
|US6728922||Aug 18, 2000||Apr 27, 2004||Network Appliance, Inc.||Dynamic data space|
|US6874001||Oct 5, 2001||Mar 29, 2005||International Business Machines Corporation||Method of maintaining data consistency in a loose transaction model|
|US6880060||Apr 24, 2002||Apr 12, 2005||Sun Microsystems, Inc.||Method for storing metadata in a physical sector|
|US20030070042||Sep 28, 2001||Apr 10, 2003||James Byrd||Storage array having multiple erasure correction and sub-stripe writing|
|US20030140299||Jan 22, 2002||Jul 24, 2003||Sun Microsystems, Inc.||Error detection in storage data|
|US20030145270||Jan 31, 2002||Jul 31, 2003||Holt Keith W.||Method for using CRC as metadata to protect against drive anomaly errors in a storage array|
|US20030163777||Feb 28, 2002||Aug 28, 2003||Holt Keith W.||Optimized read performance method using metadata to protect against drive anomaly errors in a storage array|
|US20030188216||May 8, 2002||Oct 2, 2003||International Business Machines Corporation||Controlling the state of duplexing of coupling facility structures|
|US20030221155||May 24, 2002||Nov 27, 2003||Weibel David C.||Error detection using data block mapping|
|US20040123032||Dec 24, 2002||Jun 24, 2004||Talagala Nisha D.||Method for storing integrity metadata in redundant data layouts|
|US20040153746||Jul 31, 2003||Aug 5, 2004||Talagala Nisha D.||Mechanisms for embedding and using integrity metadata|
|1||EMC, "The EMC CIARiiON Data Integrity Difference", May 2001, pp. 1-11.|
|Citing Patent||Filing date||Publication date||Applicant||Title|
|US7353432||Nov 25, 2003||Apr 1, 2008||Sun Microsystems, Inc.||Maintaining high data integrity|
|US8230085 *||Jul 24, 2012||Netapp, Inc.||System and method for supporting block-based protocols on a virtual storage appliance executing within a physical storage appliance|
|US8667326 *||May 23, 2011||Mar 4, 2014||International Business Machines Corporation||Dual hard disk drive system and method for dropped write detection and recovery|
|US9003360 *||Nov 5, 2010||Apr 7, 2015||The Mathworks, Inc.||Configuring attributes using configuration subgraphs|
|US20050228835 *||Apr 12, 2004||Oct 13, 2005||Guillermo Roa||System and method for supporting block-based protocols on a virtual storage appliance executing within a physical storage appliance|
|US20090248709 *||Mar 26, 2008||Oct 1, 2009||Oded Fuhrmann||Evaluating Associations Among Entities|
|US20120304025 *||May 23, 2011||Nov 29, 2012||International Business Machines Corporation||Dual hard disk drive system and method for dropped write detection and recovery|
|U.S. Classification||1/1, 714/20, 707/E17.011, 714/15, 707/999.202|
|International Classification||G06F17/30, G06F12/00|
|Cooperative Classification||Y10S707/99953, G06F17/30958|
|Dec 23, 2002||AS||Assignment|
Owner name: SUN MICROSYSTEMS, INC., CALIFORNIA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:TALAGALA, NISHA D.;REEL/FRAME:013617/0613
Effective date: 20021219
|Apr 14, 2003||AS||Assignment|
Owner name: SUN MICROSYSTEMS, INC., CALIFORNIA
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:WONG, BRIAN;REEL/FRAME:013952/0458
Effective date: 20030327
|Apr 29, 2010||FPAY||Fee payment|
Year of fee payment: 4
|Apr 9, 2014||FPAY||Fee payment|
Year of fee payment: 8
|Dec 16, 2015||AS||Assignment|
Owner name: ORACLE AMERICA, INC., CALIFORNIA
Free format text: MERGER AND CHANGE OF NAME;ASSIGNORS:ORACLE USA, INC.;SUN MICROSYSTEMS, INC.;ORACLE AMERICA, INC.;REEL/FRAME:037302/0661
Effective date: 20100212